Previous work focuses on data removal instead of data auditing. Some investigate how training data can be memorized in model parameters or outputs [1]}, [2]} so as to show the importance of data removal. Others study data removal methods from trained models, especially those that does not require retraining the model [3]}, [4]}. However, independent of how data is removed, in order to meet the compliance of data privacy regulations, it is important, especially for healthcare applications such as medical imaging analysis, to have a robust data auditing process to verify if certain data are used in a trained model.
